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Remarks 

In view of the following discussion, the Applicant submits that none of the 
claims now pending in the application are non-enabling, anticipated, or obvious 
under the respective provisions of 35 U.S.C. § 1 12, §102, and §103. Thus, the 
Applicant believes that all of these claims are now in allowable form. Applicant 
also believes that any alleged deficiencies in the specification and/or drawings 
have been satisfactorily corrected in this Response. 

It is to be understood that the Applicant, does not acquiesce to the 
Examiner's characterizations of the art of record or to Applicant's subject matter 
recited In the pending claims. Further, Applicant is not acquiescing to the 
Examinees statements as to the applicability of the prior art of record to the 
pending claims by filing this Response. , 

Objections 

A. IN THE DRAWINGS: 

The Examiner has objected to the drawings as failing to comply with 37 
C.F.R. §1 .84(p)(5) because they include the reference sign 31 1 in Fig. 3 without 
being mentioned in the written specification. 

In response, Applicant has hereinabove provided a replacement 
paragraph at page 7, lines 2-6 of the originally filed specification. Specifically, 
the replacement paragraph describes the method steps of the subject invention 
at a point where it is appropriate to introduce step 311 . Accordingly, clarification 
of where the process continues after step 309 is provided by identifying the 
process as continuing to step 311 after step 309, No new matter has been 
entered by virtue of this amendment as support is clearly found in Fig. 3. 
Accordingly, withdrawal of the objection is respectfully requested. 
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B. IN THE SPECIFICATION: 

The Examiner has indicated that the Abstract is objected to because of the 

length of the abstract 

In response, Applicant has amended the Abstract so that it Is in conformity 
with 37 C.F.R. §1.72. Accordingly, withdrawal of the objection is respectfully 
requested. 

The Examiner has also objected to the written specification because of the 
alleged inconsistency in the language at page 4, line 13. 

In response, Applicant has hereinabove amended the paragraph in 
accordance with the Examiner's recommendation (i.e., Intranet 140 has been 
changed to Intranet 141). Accordingly. Applicant respectfully requests that the 
objection be withdrawn. 

Rejections 

Rejection of Claims under 35 U.S.C. 5 112 

The Examiner has rejected claims 1-4 and 8 under 35 U.S.C. § 112, 
second paragraph as being indefinite for failing to particularly, point out and 
distinctly claim the subject matter which Applicant regards as the invention. 
Specifically, in each of the above-identified claims, there is an alleged insufficient 
antecedent basis for different phrases in the claims. 

In response, Applicant has hereinabove amended each of the above 
identified claims to correct any alleged deficiencies with regard to antecedent 
basis. The above-identified amendments are self exploratory in nature; thus, no 
additional commentary is necessary. If the Examiner still finds any antecedent 
basis problems with any of the amendment claims, Applicant requests Examiner 
to contact Applicant's below signed agent to discuss same informally before 
preparation of an additional Official Action. 
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Rejections of claims under 35 U.S.C. S 102 



Claims 1, 2 and 5-9 are rejected under 35 U.S. C. §102(e) as being 
anticipated by U.S. Patent Number 6,609,205 issued August 19, 2003 to 
Bernhard etaL (hereinafter 'Bernhard 1 '). Specifically, the Examiner alleges that 
Bernhard discloses a method for thwarting coordinated SYN denial of service 
attacks against a server In a network comprising the steps of controlling a 
network switch to divert a predetermined fraction of SYN packets destined for a 
server, to a web guard processor, establishing a first TCP connection between 
one or more clients originating the packets and the web guard processor and a 
second TCP connection between the clients and server. The Examiner offers 
Fig. 1 and Col. 4, lines 12-27 for disclosing an intrusion detection system (sensor 
1 1 ) capable of examining packets of TCP protocols. The Examiner further offers 
that Bernhard allegedly teaches monitoring the number of timed-out connections 
between the web guard server and the clients as per Col. 7, lines 28-37. The 
Examiner also offers controlling of a switch to divert all SYN packet destined to a 
server to the web guard processor. Specifially, once a SYN event occurs, the 
process determines whether ACK occurs. If the number of SYN packets 
exceeds 50, all SYN packets are released and misuse is detected per Fig. 2, Col. 
3, lines 41-52; Col. 6, lines 46-51 and Col. 9, lines 5-18. The Examiner also uses 
the above-identified portions of Bernhard to allege anticipation of elements of 
claims 2, 5, 6, 7, 8, and 9. In response the rejection is respectfully traversed. 

Applicant offers that while Bernhard is in the technical field of the subject 
invention, there are deficiencies in the exact teachings of Bernhard. "Anticipation 
requires the presence in a single prior art reference disclosure of each and every 
element of the claimed Invention , arranged as in the claim" (Lindemann 
Maschinenfabrik GmbH v. American Hoist & Derrick CoL 730 F.2d 1452, 221 
USPQ 481 , 485 (Fed. Clr. 1 984) (citing Connell v. Sears. Roebuck & Co. , 722 
F.2d 1542, 220 USPQ 193 (Fed. Cir. 1983)) (emphasis added). Bernhard fails to 
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disclose each and every element of the claimed invention', as arranged in the 

claim. ; 

The Examiner has expanded upon the claim language to force the 
teachings of the prior art to fit the claimed element, and thereby support the 
conclusion of anticipation. Such action is not permissible!. The prior art must be 
such that a person of ordinary skill in the field of the invention would consider 
there to be no difference between the claimed invention and the reference 
disclosure. Scripps Clinic & Research Foundati on v. Gerientech. Inc.. 927 F.2d 
1565 18 USPQ 2d 1001, 1010 (Fed. Cir. 1991). In other words, the prior art 

' j 

reference must put the claimed invention in the hand of one skilled in the art. In 
re Donohue , 766 F.2d 531, 533, 226 USPQ 619, 621 (Fe|d. Cir. 1985). 

Specifically, a first point is that Bemhard does notjteach, disclose or 
suggest a "predetermined fraction of SYN packets" being diverted or otherwise 
processed in accordance with the subject invention. The Examiner cites Col. 4. 
lines 12-27 to support his position on this specific element of the claimed 
invention; however, that portion of Bernhard does not spfeak of examining a 
predetermined fraction of SYN packets. Rather, it only provides for a general 
examining of packets in the overall system. Each packet coming into the sensor 
(1 1) Is examined (per Col. 4, lines 38-40), but the reference falls short in 
additional specific teachings as to how many packets are sent along this path. It 

is clearly not known by examining Bemhard how many packets are in fact tested 

i 

or how the selection of tested packets is determined, j 

The Examiner then offers three specific portions of Bemhard to allege a 

i 

teaching of what happens to packets once the alarm event has occurred. 
Specifically, the Examiner offers Col. 3. lines 41-52, Col| 6, lines 46-52 and Col. 
9, lines 5-18. However, in each of the three above cited portions of Bernhard, 
there is no specific teaching regarding diverting of all pajckets destined to a 
server to a web guard processor. For example, Col. 3, jines 41-52 presents only 
terminating a connection if intrusion is detected. That is, there is no specific 
teaching or disclosure of diverting packets by virtue of tjiis terminated 
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connection. Further, and with respect to claim 7, there is also no specific 
discussion of forwarding packets to a TCP oroxv in the manner claimed. 

Further to these points, Col. 6, lines 46-51 presents the specifics of what 
occurs in Bernhard when the count runs above 50 with a certain time period (an 
alarm is Indicated), but the cited portion does not teach , disclose or suggest 
anything with regards to diverting of packets (with respect to claims 1 and 8) or 
establishing TCP proxies (with respect to claim 7) once the alarm condition is 
realized. Finally, and with respect to Col. 9, lines 5-1 8, this cited portion 
generally discusses another embodiment of Bernhard, but does not go into 
specifics of diverting packets as indicated above (with respect to claims 1 and 8) 
or establishing TCP proxies (with respect to claim 7). 

As such, the Applicants submit that claims 1 , 7 and 8 are not anticipated 
and fully satisfy the requirements under 35 U.S.C. § 102 and are patentable 
thereunder. Furthermore, claims 2-6 and 9 depend, either directly or indirectly, 
from independent claims 1 and 8 and recite additional features thereof. As such, 
and for at least the same reasons discussed above, the Applicants submit that 
these dependent claims also fully satisfy the requirements under 35 U.S.C. § 102 
and are patentable thereunder. Therefore, the Applicants respectfully request 
that the rejection be withdrawn. 

Rejection of Claims unde r 35 U.S.C. S 103 

Claims 3 and 4 are rejected under 35 U.S.C. § 103(a) as being obvious 
and unpatentable over Bernhard in view of U.S. Published Application No. U.S. 
2003/0110394 to Sharp et al. (hereinafter Sharp), published June 12. 2003. 
Specifically, the Examiner indicates that Bernard allegedly discloses the claimed 
invention as described above with respect to the specifics indicated in the 102 
rejection section; however, Bernhard did not explicitly teach if the number of 
timed-out connections between the web guard and the clients exceed a second 
predetermined threshold to delete ail SYN packets destined for the server. 
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However, Sharp allegedly discloses a method used to detect and prevent 
spoofing where when it comes to flooding, there are four threshold levels that 
exist. As such, it would have been obvious to one of ordinary skill in the art the 
time the invention was made to combine the teachings of Sharp and the system 
of Bernhard because as higher thresholds are violated, the system automatically 
begins the process of chocking and holding certain packets while sending alarms 
and notifications to different areas in the system. The rejection is respectfully 
traversed. 

The test under 35 U.S.C. § 103 is not whether an improvement or a use 
set forth in a patent would have been obvious or non-obvious; rather the test is 
whether the claimed invention, considered as a whole , would have been obvious, 
Jones v. Hardy , 110 USPQ 1021, 1024 (Fed. Cir. 1984) (emphasis added). 
Thus, it is impermissible to focus either on the "gist" or "core" of the invention, 
Bausch & Lomb. Inc. v. Barnes-Hind/Hvdrocurve. Inc. , 230 USPQ 416, 420 (Fed. 
Cir. 1986) (emphasis added). Moreover, the invention as a whole is not 
restricted to the specific subject matter claimed, but also embraces its properties 
and the problem it solves. In re Wright, 6 USPQ 2d 1959, 1961 (Fed. Cir. 1988) 
(emphasis added). 

It has been above argued and presented that Bernhard does not form the 
basis for an adequate rejection under the anticipation statute. That is, Bernhard 
is missing important elements regarding the predetermined diversion of a number 
of packets as well as subsequently diverting all packets.. Therefore, Bernard in 
combination with any other secondary cited art which allegedly introduces 
additional features of the subject invention but still does not address the missing 
elements in Bernhard does not result in the claimed invention. Specifically, 
claims 3 and 4 depend either directly or indirectly from claim 1 which has been 
discussed above. The addition of how Sharp allegedly handles alarm conditions 
does not make the subject invention obvious in view of a method that does not 
handle SYN packet movement in the manner claimed. 
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Additionally, it is respectfully submitted that Sharp may in fact not be 
applicable prior art. It is respectfully indicated that Applicants filing date of the 
subject application is September 28, 2000. The filing date of Sharp is indicated 
as February 20, 2002. As such, Sharp was filed subsequent to the filing date of 
Applicant's invention. It is also noted that Sharp is a continuation-in-part of an 
application filed on June 6, 2001 (which is also subsequent to the filing date of 
Applicant's subject application). Also noted is that the June 6, 2001 application is 
a continuation-in-part of an application filed on May 17, 2000. Therefore, if the 
material that the Examiner is relying on to establish the teachings or suggestions 
of Sharp are contained only in the February 20, 2002 or June 6, 2001 filings, then 
Sharp is not applicable prior art under the rejection. As such, it is respectfully 
submitted that the rejection under 35 U.S.C. § 103 may be improper. At the very 
least, said rejection is imperfect in that the effective filing date of the material 
relied upon by the Examiner is at this time undetermined and the prima facie 
case of obviousness at question. "Unless the filing date of the earlier non- 
provisional application is actually needed, for example in the case of an 
interference or to overcome a reference, there is no need for the office to make a 
determination as to whether the requirement of 35 U.S.C. § 120, that the earlier 
non-provisional application discloses the invention of the second application in 
the manner provided by the first paragraph of 35 U.S.C, § 1 12, is met and 
whether a substantial portion of all of the earlier non-provisional application is 
repeated in the second application in a continuation-in-part situation." MPEP § 
201 .08. Since the filing date of the earlier non-provisional is needed, the Office 
must make the appropriate determination; as to the disclosure of material therein. 
It is respectfully submitted that the appropriate reference should be cited and 
subsequently provided to the Applicant (per MPEP 707.05(a)) to perfect or 
appropriately substantiate the 1 03 rejection. 

As such, Applicants submit that claims 3 and 4 are not obvious and fully 
satisfy the requirements under 35 U.S.C. § 103 and are patentable thereunder. 
Therefore, the Applicants respectfully request that the rejection be withdrawn. 
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CONCLUSION 

Thus, the Applicants submit that claims 1-9 are ^condition for allowance. 
Furthermore, the specification and Abstract has been anjended as requested by 
the Examiner. Accordingly, both reconsideration of this application and its swift 
passage to issue are earnestly solicited. • 

Applicants undersigned Agent thanks Examiner l^hosravan and 

i! 

Supervisory Patent Examiner Dharia for their preliminary teleconferences 
regarding the subject application. It is respectfully requested that upon review of 
this Response, and before preparation of a second OfffcSe Action, the Applicant 
be granted a telephone interview In accordance with thei| interview request faxed 
to Examiner Khosravan on March 10, 2004. Applicant is awar© of the time 
constraints place on the Examiner and thanks the Examiner in advance for 
providing the Applicant with the opportunity to discuss tine merits of the case to 
facilitate disposition of the application. 



Resp^ctfully^dbmitted , 




»agnotta, Agent 
'Reg. No. 39,322 
(732) 530-9404 



Moser, Patterson & Sheridan, LLP 
595 Shrewsbury Avenue 
Suite 100 

Shrewsbury, New Jersey 07702 
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CERTIFICATE OF FACSIMILE TRANSMISSION under 137 C.F.R. 55 1.6 and 1.8 



I certify that this correspondence is being 
37 C.F.R. §§ 1 .6 and 1 .8 on J/JAArS* a 
Commissioner for Patents, Washington, D.C. 20231, 



transmitted by facsimile under 
tnd is addressed to the 
Facsimile Number: #~?±-?Z*C* 



Type or print name of person signing certification 
Signature 
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